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We Claim 

1. A method of determining, in a communications network, an upstream 
station, among several other candidates, traversed by a packet arriving at a 
downstream station, comprising the steps of: 

a) marking the TTL field of the packet flow arriving at the upstream station, in a 
manner that uniquely identifies the upstream station among all the other 
concurrently marking upstream stations; 

b) receiving and identifying at the downstream station a marked packet flow; 

c) determining, depending upon the TTL field of the marked packet flow received, 
that said packet flow traversed the upstream station. 

2. The method as defined in claim 1 wherein step c) involves comparing the 
value of the TTL field of packets in a flow to which said packets belong with and 
without marking being performed, thereby enabling the manner of marking, which 
identifies the upstream station, to be determined 

3. The method as defined in claim 2 wherein packets are marked at each 
selected station by a single static value assigned by an external entity. 

4. The method as defined in claim 2 wherein packets are marked at each 
selected station by a single dynamic value assigned by an external entity. 

5. The method as defined in claim 2 wherein packets are marked at each 
selected station by plural dynamic values and associated marking scheme assigned 
by an external entity. 

6. The method as defined in claim 5 wherein the application of a value to the 
TTL field is one of add, subtract and replace. 
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7. The method as defined in claim 1 wherein the TTL field of the marked 
packet is identified by looking for a constant shifts in statistical parameters and in 
the distributed TTL value with marking turned on and turned off. 

8. The method as defined in claim 7 wherein step c) involves comparing the 
value of the TTL field of packets in a flow to which said packets belong with and 
without marking being performed, thereby enabling the manner of marking, which 
identifies the upstream station, to be determined. 

9. The method as defined in claim 2 wherein for flows with randomized TTL 
values the marked packet is identified by looking for constant shifts in parameters 
of statistical distribution of TTL values with marking turned on and turned off. 

10. The method as defined in claim 2 wherein each upstream marking station is 
assigned k values V. {V 1 , V 2 , ... V k } and k associated ratios It {R x , R,, ... R k }, where 
the sum of all k ratios R } is 100%; the marking station marks R. percent of the packet 
flow with a Vj value; thus uniquely identifying its marking. 

11. The method as defined in claim 2 wherein the marking station uses N 
different marking schema independently for N consecutive time windows; thus 
uniquely identifying its marking. 

12. A system for determining, in a communications network, an upstream 
station, among several other candidates, traversed by a packet arriving at a 
downstream station, comprising: 

a) means for marking the TTL field of the packet flow arriving at the upstream 
station, in a manner that uniquely identifies the upstream station among all the 
other concurrently marking upstream stations; 
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b) means for receiving and identifying at the downstream station a marked packet 
flow; 

c) means for determining depending upon the TTL field of the marked packet flow 
received that said packet flow traversed the upstream station. 

13. The system as defined in claim 12 wherein the value of the marked packet is 
assigned dynamically by an external entity. 

14. The system as defined in claim 12 wherein the upstream station to mark 
packets is selected by the external entity. 

15. The system as defined in claim 12 wherein the upstream station to mark 
packets is selected by a group of network edge stations marking concurrently. 

16. The system as defined in claim 12 wherein the upstream station to mark 
packets is selected by a group of network edge stations marking concurrently with 
a common primary mark and one selected station of the group using a secondary 
unique mark, the selection of the station using the secondary mark rotating among 
stations of the group, 

17. The system as defined in claim 12 wherein the downstream station is one of 
an edge router; a last mile router; receiving device and a network management 
system. 

18. The system as defined in claim 12 wherein the upstream station, also 
referred to as marking station, is one of a generic router; a core router; an edge 
router; a single network interface; a last mile router; a network appliance such as a 
proxy, a firewall, a NAT box, a VPN device. 



